pith. sign in

arxiv: 2605.06833 · v1 · submitted 2026-05-07 · 💻 cs.CR · cs.AI· cs.NI

PAMPOS: Causal Transformer-based Trajectory Prediction for Attack-Agnostic Misbehavior Detection in V2X Networks

Pith reviewed 2026-05-11 00:47 UTC · model grok-4.3

classification 💻 cs.CR cs.AIcs.NI
keywords misbehavior detectionV2X networkstransformer modeltrajectory predictionanomaly scoringattack-agnosticVeReMi++ datasetkinematic features
0
0 comments X

The pith

A causal transformer-decoder trained on benign trajectories detects unseen V2X misbehavior by flagging deviations in next-step predictions.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

PAMPOS trains a causal transformer-decoder only on normal vehicle trajectories to learn standard mobility patterns. Misbehavior is detected when actual kinematics deviate from the model's predictions, scored with a top-K normalized mechanism that points to specific features like position or velocity. This attack-agnostic method requires no labeled attack data during training, unlike previous supervised approaches. It was tested on all 19 attack types from the VeReMi++ dataset in rush-hour and afternoon settings with high accuracy metrics.

Core claim

PAMPOS is a causal transformer-decoder trained on benign VeReMi++ trajectories to learn normal mobility patterns. At inference time, misbehavior is identified as a deviation from the model's next-step kinematic predictions using a top-K normalized anomaly scoring mechanism that localizes falsification to specific kinematic features, without requiring attack-labeled training data. Evaluation across all 19 attack types in rush-hour and afternoon scenarios yields AUC values of up to 0.98 and F1-scores of up to 0.95 for most categories.

What carries the argument

Causal transformer-decoder for next-step kinematic prediction with top-K normalized anomaly scoring to localize deviations.

If this is right

  • Achieves AUC up to 0.98 and F1 up to 0.95 across 19 attack types without attack labels.
  • Localizes falsification to particular kinematic features such as speed or position.
  • Functions effectively in both high-density rush-hour and lower-density afternoon traffic.
  • Enables detection of unseen attacks by relying solely on benign training data.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • This approach could extend to anomaly detection in other dynamic systems like UAV swarms where only normal behavior data is available.
  • The use of transformers highlights the importance of long-range temporal dependencies in modeling vehicle mobility for security.
  • Testing on real-world V2X deployments would be needed to confirm performance beyond simulations.
  • Combining with cryptographic methods could provide defense-in-depth against both external and insider threats.

Load-bearing premise

That deviations in predicted kinematics always indicate malicious falsification rather than legitimate but unusual driving behaviors, and that the model trained on benign data generalizes to any unseen attack.

What would settle it

Running the model on a set of normal trajectories that include rare but valid events like emergency stops and measuring if they trigger high anomaly scores.

Figures

Figures reproduced from arXiv: 2605.06833 by Ahmed Mohamed Hussain, Konstantinos Kalogiannis, Panos Papadimitratos.

Figure 1
Figure 1. Figure 1: PAMPOS causal transformer-decoder architecture and parameters. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 3
Figure 3. Figure 3: presents the Receiver Operating Characteristic (ROC) curves for all nineteen attack scenarios, with the legend sorted by AUC. The majority of attacks achieve AUC values between 0.93 0 0.2 0.4 0.6 0.8 1 False Positive Rate 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 True Positive Rate A14 DoS Random (AUC=0.980) A15 DoS Disruptive (AUC=0.979) A18 DoS Random Sybil (AUC=0.979) A19 DoS Disruptive Sybil (AUC=0.978) … view at source ↗
Figure 2
Figure 2. Figure 2: Feature prediction error. 𝐾=4, though this would dilute the scores for position-concentrated attacks (A1, A3). 𝐾=3 provides a conservative, but robust default. Nonetheless, top-𝐾 co-selection patterns offer insights into the attack family: speed co-selection identifies speed attacks (A5, A7, A8), while heading co-selection identifies disruptive attacks [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. Figure 4: Anomaly scores. to afternoon) yields nearly identical aggregate performance (mean AUC = 0.95, mean F1 = 0.86), confirming symmetric generalization. This is expected: relative kinematic features are invariant to abso￾lute position, road topology, and traffic density, so patterns learned from afternoon traffic transfer directly to rush hour conditions. 6 Conclusion We presented PAMPOS, an unsupervised MDS fo… view at source ↗
read the original abstract

Misbehavior detection in Vehicle-to-Everything (V2X) networks is a second line of defense against insider falsification attacks that cryptographic mechanisms alone cannot address. Existing learning-based Misbehavior Detection Schemes (MDSs) are supervised, requiring labeled attack samples at training time, thus failing to counter unseen falsification attacks. We present PAMPOS, a causal transformer-decoder trained on benign VeReMi++ trajectories to learn normal mobility patterns. At inference time, misbehavior is identified as a deviation from the model's next-step kinematic predictions using a top-K normalized anomaly scoring mechanism that localizes falsification to specific kinematic features, without requiring attack-labeled training data. We evaluate PAMPOS across all 19 attack types in VeReMi++ under rush-hour and afternoon scenarios, achieving Area Under the Curve (AUC) values of up to 0.98 and F1-scores of up to 0.95 for most attack categories.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper introduces PAMPOS, a causal transformer-decoder trained exclusively on benign trajectories from the VeReMi++ dataset to model normal vehicle mobility patterns in V2X networks. Misbehavior detection is performed by identifying deviations from the model's next-step kinematic predictions using a top-K normalized anomaly scoring mechanism that can localize the falsification to specific features. The method is evaluated on all 19 attack types in the dataset under rush-hour and afternoon scenarios, reporting AUC values up to 0.98 and F1-scores up to 0.95.

Significance. If the results hold, this work would be significant for the field of V2X security as it offers an attack-agnostic misbehavior detection scheme that does not require labeled attack data during training, addressing a major limitation of existing supervised approaches. The use of a causal transformer for trajectory prediction and the feature-localizing anomaly score represent a novel application in this domain. The comprehensive evaluation across multiple attack types and scenarios strengthens the case for practical applicability, provided the generalization to unseen benign variations is confirmed. The attack-agnostic training on benign data only is a clear strength.

major comments (2)
  1. [Abstract and Evaluation] The abstract and evaluation sections report strong AUC (up to 0.98) and F1 (up to 0.95) scores across 19 attacks but provide no details on model architecture depth, training hyperparameters, exact anomaly threshold selection, or statistical significance testing. These omissions are load-bearing for assessing the reliability of the central performance claims.
  2. [Results and Discussion] No separate false-positive evaluation is reported on held-out benign trajectories containing rare but valid maneuvers (e.g., abrupt decelerations in dense rush-hour traffic). Without this analysis, it remains unclear whether the top-K normalized anomaly scoring reliably distinguishes falsifications from legitimate distribution shifts, which directly underpins the attack-agnostic guarantee.
minor comments (2)
  1. [Method] The description of the top-K normalized anomaly scoring mechanism could be expanded with a precise algorithmic definition or pseudocode to improve reproducibility.
  2. [Abstract] Consider adding a brief note on the number of benign trajectories used for training to provide context for the reported generalization.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback. The comments highlight important aspects for strengthening reproducibility and validating the attack-agnostic claims. We address each major comment below and will incorporate revisions accordingly.

read point-by-point responses
  1. Referee: [Abstract and Evaluation] The abstract and evaluation sections report strong AUC (up to 0.98) and F1 (up to 0.95) scores across 19 attacks but provide no details on model architecture depth, training hyperparameters, exact anomaly threshold selection, or statistical significance testing. These omissions are load-bearing for assessing the reliability of the central performance claims.

    Authors: We agree that these implementation and evaluation details are necessary for assessing reliability and enabling reproduction. In the revised manuscript, we will expand the Methods and Evaluation sections to specify the causal transformer architecture (number of layers, attention heads, hidden dimensions, and decoder-only configuration), all training hyperparameters (learning rate schedule, batch size, number of epochs, optimizer, and regularization), the anomaly threshold selection procedure (e.g., chosen on a held-out benign validation set to target a specific false-positive rate), and statistical significance (standard deviation across multiple random seeds or runs, with confidence intervals on AUC/F1). We will also briefly reference these additions in the abstract if space permits. revision: yes

  2. Referee: [Results and Discussion] No separate false-positive evaluation is reported on held-out benign trajectories containing rare but valid maneuvers (e.g., abrupt decelerations in dense rush-hour traffic). Without this analysis, it remains unclear whether the top-K normalized anomaly scoring reliably distinguishes falsifications from legitimate distribution shifts, which directly underpins the attack-agnostic guarantee.

    Authors: We acknowledge the importance of explicitly demonstrating that the top-K normalized anomaly score does not flag legitimate but rare benign behaviors. While the current evaluation already computes anomaly scores on held-out benign trajectories from VeReMi++ (separate from training data) and reports low false positives overall, we did not isolate subsets with rare valid maneuvers such as abrupt decelerations. In the revision, we will add a dedicated false-positive analysis subsection that examines the distribution of anomaly scores on all held-out benign test trajectories, with particular attention to rush-hour scenarios that may contain abrupt but valid kinematic changes. This will include quantitative results showing that the scoring mechanism maintains high specificity on benign data, thereby supporting the attack-agnostic property. revision: yes

Circularity Check

0 steps flagged

No circularity: standard anomaly detection trained only on benign data

full rationale

The paper trains a causal transformer-decoder exclusively on benign VeReMi++ trajectories to learn normal mobility patterns, then flags misbehavior via deviation from next-step kinematic predictions using a top-K normalized anomaly score. This is the standard unsupervised anomaly detection setup and does not reduce any performance claim or detection rule to a quantity fitted on attack data, a self-citation chain, or a definitional tautology. No equations, derivations, or load-bearing steps in the abstract or described method exhibit self-definitional, fitted-input, or uniqueness-imported circularity. Evaluation on the 19 attack types occurs after training and is independent of the training inputs.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract-only review provides no explicit free parameters, axioms, or invented entities; the model implicitly relies on standard transformer assumptions and the VeReMi++ dataset definition, but none are detailed enough to enumerate.

pith-pipeline@v0.9.0 · 5479 in / 1256 out tokens · 82047 ms · 2026-05-11T00:47:24.410800+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

What do these tags mean?
matches
The paper's claim is directly supported by a theorem in the formal canon.
supports
The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends
The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses
The paper appears to rely on the theorem as machinery.
contradicts
The paper's claim conflicts with a theorem or certificate in the canon.
unclear
Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Reference graph

Works this paper leans on

27 extracted references · 27 canonical work pages

  1. [1]

    1609_WG - V2X Communications Working Group . 2022. IEEE Standard for Wireless Access in Vehicular Environments–Security Services for Application and Management Messages.IEEE Vehicular Technology Society(Jan. 2022)

  2. [2]

    Alladi et al. 2021. DeepADV: A Deep Neural Network Framework for Anomaly Detection in VANETs.IEEE Transactions on Vehicular Technology70, 11 (2021)

  3. [3]

    Abdelwahab Boualouache and Thomas Engel. 2023. A Survey on Machine Learning-Based Misbehavior Detection Systems for 5G and Beyond Vehicular Networks.IEEE Communications Surveys & Tutorials25, 2 (2023)

  4. [4]

    Enrique Campos, Roshan Sedar, Charalampos Kalalas, João Vinagre, and Gregorio Llano. 2025. Federated Learning for Misbehaviour Detection with Variational Autoencoders and Gaussian Mixture Models.International Journal of Information Security(2025)

  5. [5]

    Secil Ercan, Marwane Ayaida, and Nadhir Messai. 2022. Misbehavior Detection for Position Falsification Attacks in VANETs Using Machine Learning.IEEE Access10 (2022)

  6. [6]

    ETSI. 2016. Intelligent Transport Systems (ITS); Security; ITS Communications Security Architecture and Security Management

  7. [7]

    2025.Keras

    François Chollet. 2025.Keras. https://keras.io/ Accessed: Feb 2025

  8. [8]

    Francesco Giuliari, Irtiza Hasan, Marco Cristani, and Fabio Galasso. 2021. Trans- former Networks for Trajectory Forecasting. In2020 25th International Conference on Pattern Recognition (ICPR). IEEE

  9. [9]

    2025.TensorFlow

    Google. 2025.TensorFlow. https://www.tensorflow.org Accessed: Feb 2025

  10. [10]

    Sohan Gyawali, Yi Qian, and Rose Qingyang Hu. 2020. Machine Learning and Reputation Based Misbehavior Detection in Vehicular Communication Networks. IEEE Transactions on Vehicular Technology69, 8 (2020)

  11. [11]

    Hsu et al. 2022. A Deep Learning-Based Integrated Algorithm for Misbehav- ior Detection System in VANETs. InProceedings of the 2021 ACM International Conference on Intelligent Computing and its Emerging Applications

  12. [12]

    Huang et al. 2025. UltraADV: An Unsupervised Deep Learning Lightweight Framework for Anomaly Detection in V2X.IEEE Internet of Things Journal12, 9 (2025)

  13. [13]

    Konstantinos Kalogiannis, Andreas Henriksson, and Panos Papadimitratos. 2023. Vulnerability analysis of vehicular coordinated maneuvers. InIEEE EuroS&PW

  14. [14]

    Konstantinos Kalogiannis, Ahmed Mohamed Hussain, Hexu Li, and Panos Pa- padimitratos. 2025. Attention in Motion: Secure Platooning via Transformer- based Misbehavior Detection.arXiv preprint arXiv:2512.15503(2025)

  15. [15]

    Konstantinos Kalogiannis, Mohammad Khodaei, Weaam Mostafa Nemr Mohamed Bayaa, and Panos Papadimitratos. 2022. Attack impact and misbehavior detection in vehicular platoons. InProceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks

  16. [16]

    Kamel et al. 2020. Simulation Framework for Misbehavior Detection in Vehicular Networks.IEEE Transactions on Vehicular Technology69, 6 (2020)

  17. [17]

    Kamel et al. 2020. Veremi extension: A dataset for comparable evaluation of misbehavior detection in vanets. InICC 2020-2020 IEEE International Conference on Communications (ICC). IEEE

  18. [18]

    Khodaei et al

    M. Khodaei et al. 2018. SECMACE: Scalable and Robust Identity and Credential Management Infrastructure in Vehicular Communication Systems.IEEE TITS19, 5 (May 2018)

  19. [19]

    Mohammad Khodaei and Panos Papadimitratos. 2021. Scalable & Resilient Vehicle- Centric Certificate Revocation List Distribution in Vehicular Communication Systems.IEEE Transactions on Mobile Computing (IEEE TMC)20, 7 (July 2021)

  20. [20]

    Hexu Li, Konstantinos Kalogiannis, Ahmed Mohamed Hussain, and Panos Pa- padimitratos. 2025. AttentionGuard: Transformer-based Misbehavior Detection for Secure Vehicular Platoons. InProceedings of the 2025 ACM Workshop on Wireless Security and Machine Learning

  21. [21]

    Xiangyu Liu. 2022. Misbehavior Detection based on Deep Learning for VANETs. In2022 International Conference on Networks, Communications and Information Technology (CNCIT). IEEE

  22. [22]

    Zhikang Liu, Hongyun Xu, Yong Kuang, and Feng Li. 2023. Svmdformer: A semi- supervised vehicular misbehavior detection framework based on transformer in iov. In2023 IEEE 43rd International Conference on Distributed Computing Systems (ICDCS). IEEE. PAMPOS: Trajectory Prediction for Attack-Agnostic Misbehavior Detection in V2X Networks WiseML ’26, June 30-J...

  23. [23]

    Holczer, E

    Panos Papadimitratos, Levente Buttyan, T. Holczer, E. Schoch, J. Freudiger, Maxim Raya, Z. Ma, Frank Kargl, A. Kung, and Jean-Pierre Hubaux. 2008. Secure Vehic- ular Communication Systems: Design and Architecture.IEEE Communications Magazine46, 11 (November 2008)

  24. [24]

    Maxim Raya, Panos Papadimitratos, Virgil Gligor, and Jean-Pierre Hubaux. 2008. On Data-Centric Trust Establishment in Ephemeral Ad hoc Networks. InIEEE Conference on Computer Communications (IEEE INFOCOM). Phoenix, AZ, USA

  25. [25]

    Rens W Van Der Heijden, Thomas Lukaseder, and Frank Kargl. 2018. Veremi: A dataset for comparable evaluation of misbehavior detection in vanets. In14th International Conference, SecureComm 2018, Singapore, Singapore, August 8-10, 2018

  26. [26]

    Vaswani et al. 2017. Attention is all you need.Advances in neural information processing systems30 (2017)

  27. [27]

    Sobh, Ayman M

    Nayera Youness, Ahmad Mostafa, Mohamed A. Sobh, Ayman M. Bahaa, and Khaled Nagaty. 2025. VeMisNet: Enhanced Feature Engineering for Deep Learning-Based Misbehavior Detection in Vehicular Ad Hoc Networks.Journal of Sensor and Actuator Networks14, 5 (2025)